diff --git a/microdroid/payload/metadata.proto b/microdroid/payload/metadata.proto
index 4c32dde..5ae2158 100644
--- a/microdroid/payload/metadata.proto
+++ b/microdroid/payload/metadata.proto
@@ -31,14 +31,13 @@
 
 message ApexPayload {
   // Required.
-  // The apex name.
   string name = 1;
-
   string partition_name = 2;
 
   // Optional.
-  // When specified, the public key used to sign the apex should match with it.
+  // When specified, apex payload should be verified with the public key and root digest.
   bytes public_key = 3;
+  bytes root_digest = 4;
 }
 
 message ApkPayload {